Merge branch 'main' into media_refactor

1 files changed, 30 insertions, 15 deletions

diff --git a/internal/email/util.go b/internal/email/util.go
index db95128fa..52290dbe4 100644
--- a/internal/email/util.go
+++ b/internal/email/util.go
@@ -19,15 +19,12 @@
 package email
 
 import (
+	"errors"
 	"fmt"
-	"html/template"
 	"os"
 	"path/filepath"
-)
-
-const (
-	mime = `MIME-version: 1.0;
-Content-Type: text/html;`
+	"strings"
+	"text/template"
 )
 
 func loadTemplates(templateBaseDir string) (*template.Template, error) {
@@ -41,16 +38,34 @@ func loadTemplates(templateBaseDir string) (*template.Template, error) {
 	return template.ParseGlob(tmPath)
 }
 
-func assembleMessage(mailSubject string, mailBody string, mailTo string, mailFrom string) []byte {
-	from := fmt.Sprintf("From: GoToSocial <%s>", mailFrom)
-	to := fmt.Sprintf("To: %s", mailTo)
+// https://datatracker.ietf.org/doc/html/rfc2822
+// I did not read the RFC, I just copy and pasted from
+// https://pkg.go.dev/net/smtp#SendMail
+// and it did seem to work.
+func assembleMessage(mailSubject string, mailBody string, mailTo string, mailFrom string) ([]byte, error) {
+
+	if strings.Contains(mailSubject, "\r") || strings.Contains(mailSubject, "\n") {
+		return nil, errors.New("email subject must not contain newline characters")
+	}
+
+	if strings.Contains(mailFrom, "\r") || strings.Contains(mailFrom, "\n") {
+		return nil, errors.New("email from address must not contain newline characters")
+	}
+
+	if strings.Contains(mailTo, "\r") || strings.Contains(mailTo, "\n") {
+		return nil, errors.New("email to address must not contain newline characters")
+	}
+
+	// normalize the message body to use CRLF line endings
+	mailBody = strings.ReplaceAll(mailBody, "\r\n", "\n")
+	mailBody = strings.ReplaceAll(mailBody, "\n", "\r\n")
 
 	msg := []byte(
-		mailSubject + "\r\n" +
-			from + "\r\n" +
-			to + "\r\n" +
-			mime + "\r\n" +
-			mailBody + "\r\n")
+		"To: " + mailTo + "\r\n" +
+			"Subject: " + mailSubject + "\r\n" +
+			"\r\n" +
+			mailBody + "\r\n",
+	)
 
-	return msg
+	return msg, nil
 }